Connect with us

Crypto

CherryBlos Malware Uses OCR to Pluck Android Users’ Cryptocurrency

Published

on

CherryBlos Malware Uses OCR to Pluck Android Users’ Cryptocurrency

Researchers this week warned of two related malware campaigns, dubbed CherryBlos and FakeTrade, targeting Android users for cryptocurrency theft and other financially motivated scams. The operators of the campaign are distributing the malware via fake Android apps on Google Play, social media platforms, and phishing sites.

In a report this week, Trend Micro said its researchers had discovered the two malware strains recently and had observed the malware using the same network infrastructure and application certificates. This points to the same threat actor being behind both campaigns, the researchers noted.

One, somewhat unusual — and dangerous — feature in CherryBlos is its ability to use optical character recognition (OCR) to read any mnemonic phrases that might be present in pictures on a compromised host device, and to send that data to its command-and-control server (C2). In the context of cryptocurrency, mnemonic phrases are what people use when they want to recover or restore a crypto wallet.

“From the language used by these samples, we determined that the threat actor doesn’t have a specific targeted region, but targets victims across the globe, replacing resource strings and uploading these apps to different Google Play regions,” Trend Micro said. These regions include Malaysia, Vietnam, Philippines, Indonesia, Uganda, and Mexico, the security vendor said.

The CherryBlos Campaign

The CherryBlos malware is engineered to steal cryptocurrency wallet-related credentials, and to replace a victim’s wallet address when they make withdrawals. Trend Micro said it had observed the malware operator using Telegram, TikTok, and X (the platform formerly known as Twitter), to display ads promoting fake Android apps containing the malware. The ads typically pointed to phishing sites that hosted the fake apps. Trend Micro said it had identified at least four fake Android apps containing CherrBlos: GPTalk, Happy Miner, Robot99, and SynthNet.

Advertisement

CherryBlos is similar to other Android banking Trojans in that it requires Android’s accessibility permissions in order to work. These are permissions for making Android apps more usable for users with disabilities, and include permissions for reading screen content out loud, automating repetitive tasks, and for alternate ways to interact with the device — such as using gestures. With CherryBlos, when a user opens the app, it displays a popup prompting the use to enable accessibility permissions, Trend Micro said.

Once installed on a device, CherryBlos retrieves two configuration files from its C2. It also uses multiple methods for persistence and to evade anti-malware controls. The malware’s persistence mechanisms include automatically approving various permission requests and sending the user back to the home screen when they attempt to access the app’s settings.

FakeTrade Campaign

For the FakeTrade campaign, which features similar technology, the threat actor has so far used at least 31 fake Android apps to distribute the malware. Many of these fake apps have featured shopping-related themes and have claimed users could earn money by completing certain tasks or by purchasing additional credit in an application. Often when users fell for the lure and topped-up their accounts, they were subsequently unable to withdraw from it later.

Many of the apps in the FakeTrade campaign were available on Google Play in 2021 and for the first three quarters of 2022. But Google has removed all of the offending apps since then, Trend Micro said. Even so, FakeTrade and CherryBlos continue to present a significant threat for Android users: “The threat actor behind these campaigns employed advanced techniques to evade detection, such as software packing, obfuscation, and abusing Android’s Accessibility Service,” according to the report.

Advertisement
Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Crypto

Streamlined Cryptocurrency-Focused Apps

Published

on

Streamlined Cryptocurrency-Focused Apps
Blaqclouds, Inc. has introduced ShopwithCrypto.io, a Progressive Web App designed to enhance cryptocurrency usability in daily transactions. This app offers a streamlined, multi-device experience that supports over 250 cryptocurrencies across major blockchain networks like ETH, BNB, and MATIC.

Key features of ShopwithCrypto.io include offline functionality, QR code integration, and the ability to purchase gift cards from global merchants, all while ensuring security and transparency through the ZEUS Blockchain. The Progressive Web App’s lightweight design and compatibility with both Android and iOS platforms make it accessible without the need for app store downloads. By combining ease of use with robust security measures, it aims to bridge the gap between digital assets and real-world spending. Its integration with popular wallets like MetaMask allows users to manage their transactions seamlessly while maintaining control of private keys.

Image Credit: Blaqclouds, Inc.

Continue Reading

Crypto

Delta police targeting cryptocurrency scams

Published

on

Delta police targeting cryptocurrency scams

DPD and blockchain analytics company Chainalysis co-hosted other law enforcement agencies and cryptocurrency exchanges for ‘Operation DeCloak’

A cryptocurrency fraud workshop co-hosted by the Delta Police Department last fall identified over 1,100 victims worldwide, including a ‘significant number’ in Canada.

On Sept. 16 and 17, 2024, the DPD and blockchain analytics company Chainalysis hosted “Operation DeCloak,” bringing together representatives from law enforcement agencies including the RCMP, Victoria Police Department, Vancouver Police Department, the BC Securities Commission, the BC Prosecution Service and the BC Financial Services Authority, as well as key stakeholders from cryptocurrency exchanges such as Shakepay and others.

The initiative was a localized “sprint” of Chainalysis’ “Operation Spincaster,” a series of public-private collaborations designed to disrupt and prevent cryptocurrency scams. Spincaster itself spun out from “Operation Disruption,” a collaboration between Chainalysis and the Calgary Police Service in March 2024.

“Leveraging the transparency of the blockchain, Chainalysis proactively identified thousands of compromised wallets. This actionable intelligence formed the basis of a series of operational sprints across six countries (U.S., U.K., Canada, Spain, Netherlands and Australia) with over 100 attendees, including 12 public sector agencies and 17 crypto exchanges,” the company said in a press release.

Advertisement

“Over 7,000 leads were disseminated during these sprints, relating to approximately US$162 million of losses. These leads were used to close accounts, seize funds and build intelligence to prevent future scams.”

During last fall’s Operation DeCloak, Chainalysis led training sessions in investigating leads, tracing stolen funds and identifying compromised wallets using the company’s proprietary “Crypto Investigations Solution.”

According to a DPD press release, 240 crypto addresses were closely examined, revealing an estimated collective loss of C$35 million.

SEE ALSO: Court rejects environmental challenge to massive Delta port expansion

The event also promoted proactive policing and disruption strategies aimed at combating fraud, with particular emphasis on a growing tactic known as “approval phishing” used by romance and investment scammers targeting cryptocurrency transactions. 

Advertisement

The method involves scammers gaining their victim’s trust by promoting false investment opportunities with the promise of high returns, thereby convincing victims to unknowingly approve malicious blockchain transactions.

The initial transaction gives the scammer access to tokens in the victim’s digital wallet without the victim’s knowledge, resulting in unauthorized withdrawals.

Police say scammers typically connect with their victims through social media, or via apps or pop-up ads.

During Operation DeCloak, police say immediate steps were taken to notify identified victims of these scams.

“With the co-operation of the exchange companies, affected individuals were promptly contacted with the goal of preventing further harm,” the DPD said in its press release.

Advertisement

Since the workshop, the department has successfully deployed the techniques learned through Operation DeCloak. 

“The technique was applied to a previous investigation which identified stolen cryptocurrency funds in a blacklisted address containing US$1.2 million. This address was in the process of being seized by an overseas police agency,” the department said.

Using the DeCloak techniques, the DPD’s Cybercrime Unit has identified an additional 70 transactions worth US$800,000 sent from Canadian exchanges. Investigators are identifying those victims and seizing the funds from the blacklisted address so they can be returned.

“This collaboration with Chainalysis and cryptocurrency exchanges is a testament to the DPD’s focus on innovation and commitment to community safety and well-being.”

SEE ALSO: Conservative candidate files court petition over Surrey ‘voting irregularities’

Advertisement

SEE ALSO: Good Samaritan saves 3 people in fiery single-car crash in Surrey

Continue Reading

Crypto

Coinbase Investigates ‘Delayed Sends’ for XRP on Its Platform | PYMNTS.com

Published

on

Coinbase Investigates ‘Delayed Sends’ for XRP on Its Platform | PYMNTS.com

Cryptocurrency exchange Coinbase said Tuesday (Jan. 14) that it is investigating a problem with delayed sends of Ripple (XRP) on its platform.

“We are aware that some users may be experiencing delayed sends for Ripple (XRP),” Coinbase said in an incident report on its status page. “Buys, Sells and Fiat withdrawals/deposits are not affected. We are investigating this issue and will provide an update shortly.”

In an earlier, separate report on its status page, Coinbase said some users experienced delayed sends and receives for Stellar (XLM) on Friday (Jan. 10). That incident was resolved within 90 minutes.

On Thursday (Jan. 9), some users experienced latency or degraded performance with buys, sells, sends, Coinbase Onramp and Advanced Trade. That issue was resolved within two hours, according to the page.

In other, separate news about the company, it was reported Thursday (Jan. 9) that Coinbase told customers that it may have to share data demanded by the Commodity Futures Trading Commission (CFTC).

Advertisement

The regulator sent a subpoena to the firm that seeks information about Coinbase customers’ interactions with prediction market firm Polymarket, and Coinbase emailed some customers saying it may have to share that data with the CFTC.

“When we receive requests for information from a government, each request is carefully reviewed by a team of trained experts using established procedures to determine its legal sufficiency,” a Coinbase spokesperson told CoinDesk.

On Dec. 9, cryptocurrency payments solution firm Triple-A announced an integration with Coinbase that it said it designed to let Coinbase users make payments to select merchants in the Triple-A network.

“Triple-A’s integration with Coinbase Commerce will empower merchants to offer a Coinbase-specific payment option, enhancing the convenience for Coinbase users and allowing Coinbase to connect with a wider network of merchants, to drive the broader adoption of cryptocurrency payments,” the company said in a press release.

Coinbase upgraded its Coinbase One subscription program and launched a new tier called Coinbase One Premium on Dec. 4, saying that with these new offerings, “Coinbase One now truly benefits all types of traders.”

Advertisement

Coinbase One membership has reached 600,000 across 42 countries, the company added.

Continue Reading

Trending